Ransomware activity across the Middle East has risen sharply, with organised criminal groups increasingly taking aim at Gulf businesses and sectors where disruption can put greater pressure on victims to pay, according to new research.
Ransomware activity tracked by cybersecurity company CloudSEK rose from 17 incidents in April 2025 to 357 in June this year, with the company saying the increase reflected a growing focus on the region by established criminal groups.
“The Gulf states were, until recently, not a primary ransomware target,” Anirudh Batra, threat researcher at CloudSEK, told The National. “What our data shows is that changed in 2025, and it changed fast.”
Groups including The Gentlemen built databases of compromised network devices and repeatedly attacked Saudi businesses, while Nova operated throughout the 17-month reporting period with the Gulf as a focus, he said.
“These groups are not testing the market. They have committed to it,” Mr Batra said.
The growth of digital infrastructure across Saudi Arabia and the UAE has increased the number of internet-facing systems available to attackers, while unpatched firewalls and VPN gateways remain common entry points, he said.
Gavin Millard, vice president of intelligence at cybersecurity company Tenable, said ransomware's rise was part of a longer global trend.
“Cyber crime and the tactics they use really is a borderless activity when it comes to things like ransomware,” Mr Millard told The National.
Attackers are often less interested in where a company is based than in finding “the easiest and the most profitable victims”, he said.
Israel and Turkey face different threats
Israel recorded the highest overall cyber-threat activity in CloudSEK's data, followed by Turkey, Iran, the UAE and Saudi Arabia. The figures are threat-intelligence indicators rather than confirmed, successful attacks.
Mr Batra said 37.8 per cent of all hacktivist activity recorded in the region was directed at Israel, alongside sustained Iranian state-linked intelligence operations.
Turkey, meanwhile, led the region for ransomware activity, with criminals attracted to its manufacturing, construction, defence and logistics sectors.
“Israel is targeted because of who it is. Turkey is targeted because of what it has,” Mr Batra said.
Critical infrastructure can be particularly attractive to ransomware gangs because disruption can affect services as well as computer systems.
“When the impact is higher, the ransom can also be higher,” Mr Millard said. “People are going to pay more to restore infrastructure that is population-impacting than just business-impacting.”
The potential cost was highlighted in the UAE on Tuesday when Dr Mohamed Al Kuwaiti, head of the UAE Cyber Security Council, revealed that a hacker had demanded more than $5 million after claiming to breach a private company, destroying data and trying to leak stolen information. UAE authorities worked with the company to contain the attack and prevent further circulation of its data, said Dr Al Kuwaiti.
Mohamed Belarbi, founder and chief executive of Cypherleak, told The National last week that the greater risk was an accumulation of relatively inexpensive attacks causing local cuts, business disruption and recovery costs, rather than one catastrophic shutdown.
The UAE has reported a sharp increase in cyber threats since the outbreak of the war. Dr Al Kuwaiti said in April that the country was facing about 800,000 hacking attempts a day, compared with as many as 200,000 before the conflict.
The council has also reported thwarting organised attacks on the country's aviation, energy and education sectors in August, a month after it said sophisticated attacks against the financial sector had been detected and contained without disrupting services.
AI reduces barrier for new hackers
Iranian-linked groups feature prominently in CloudSEK's report, but it also tracked operations linked or attributed by security researchers to China and Israel, alongside North Korean and Russia-aligned activity.
China-linked groups exploited vulnerabilities in network equipment to access government, telecommunications and healthcare organisations for intelligence gathering, Mr Batra said.
“What we see is a genuinely complex picture,” he said, with state-linked groups pursuing different objectives while international ransomware operators attack the region for money.
Artificial intelligence is adding another dimension.
CloudSEK said Iran-linked MuddyWater used Google's Gemini to help develop attack tools, while APT42 used AI to produce more convincing phishing messages aimed at Israeli journalists, defence workers and academics.
Mr Batra said AI's immediate impact was primarily speed and scale. It can help less-experienced operators to develop tools and enable attackers to produce convincing phishing messages across languages more quickly.
AI is not, however, independently selecting targets or carrying out attacks without human direction, he said.
Mr Millard agreed that AI was amplifying established methods rather than creating an entirely new form of cyber attack.
“AI-enabled attacks aren't novel, and they're not indefensible,” he said. “They're just amplified in scale.”
Mr Millard said AI had also significantly lowered the barrier to entry, making it “far easier for a lone wolf to have the skills and capabilities of a state-based actor”.
AI can automate stages of an attack, from identifying known vulnerabilities to finding potential victims and using ransomware, reducing the time defenders have to react, he said.
For businesses, Mr Millard said the answer was not trying to fix every possible weakness but identifying those that attackers are actually likely to exploit.
“Compliance is not security,” he said. “No one can deal with the volume of issues that are being highlighted by these models. You have to take a more pragmatic, risk-based, threat-based approach.”
